Recently, around midnight, while my iMac is in sleep mode, my Intego Firewall Log shows that it's blocking an incoming connection from within a network, particularly a house tenant's Windows HP laptop.

The source is the tenant's computer. And for about an hour, incrementally different ports from his computer tries to interact with my destination ports (135, 139, and 445), using a TCP SMB/CIFS Windows service file, TCP Microsoft Domain Server, or his TCP Port 135.

Now I don't want to be rude and confront him while looking all paranoid.

Could someone tell me what my log means? Am I being hacked? Is his computer infected? Or is it standard for computers to "sniff" each other out?

Attached Files:

Ports 135, 139, and 445 are associated with the most commonly exploited services in Windows NT based operating systems (includes XP, Vista, & 7). I think it is fair to suggest that his machine might be a host to malware that is attempting to spread within the network.

It may be something else? Possibly related to Windows "Homegroups" for media sharing? I think WMP uses port 445 with the SMB protocol.

These are not the default ports used for service discovery (to "sniff" each other out).

It is highly unlikely you are being hacked. FYI, more about Mac OS X firewalling -> 1 & 2

MacRumors attracts a broad audience
of both consumers and professionals interested in
the latest technologies and products. We also boast an active community focused on
purchasing decisions and technical aspects of the iPhone, iPod, iPad, and Mac platforms.